Alternatives to CSF

Webmin
1
SYSTEM INFORMATION
OS type and version AlmaLinux 8.10
Webmin version 2.670
Virtualmin version 8.3.0 GPL

With the death of ConfigServer, I decided to uninstall CSF via the CLI and install Fail2Ban and Linux Firewall from the Webmin interface under “Networking”. However, uninstalling CSF via CLI did not remove or deactivate the old ConfigServer Security and Firewall module under Webmin > System.

Is there a way to remove the module? I can’t seem to find a way; clicking on the module in Webmin > System shows an empty directory on disk, and “Refresh Modules” doesn’t seem to recognize that the directory and files no longer exist on disk.

Other than paid options, is Fail2Ban and Linux Firewall a good replacement for the old ConfigServer and LFD?

2

If you want to completely remove the old CSF installation and install the new version, you can do the following:

First, uninstall the existing CSF:

sh /etc/csf/uninstall.sh

Then install the new version by following the official installation instructions:

https://docs.configserver.dev/install/quickstart/install/

Atherinox is continuing the development and maintenance of CSF, and the new version works essentially the same way as the previous version, while continuing to receive updates and improvements.

So if you are already familiar with CSF, the transition should be straightforward.

Edit:
If you’re using Webmin, you can also install the ConfigServer Security & Firewall module from the official Webmin documentation:

https://webmin.com/docs/third-party-modules/configserver-security-and-firewall/

This will add the CSF management interface directly to Webmin.

3

CSF isn’t dead. It’s currently with another developer and active. I use it normally.
CSF Firewall
v.15.10

4

Thanks for that guidance! I wasn’t sure which forks to use, and had actually tried to install Atherinox but was running into issues with LFD for some reason, and I couldn’t access the UI in a browser. The Webmin documentation helped getting the Webmin module installed, and I’m more comfortable using the module than using the web interface.

5

I’m going to pre-announce something, which I don’t normally do, but it’s directly relevant, and the web page and backend service is up and running.

For the past several weeks, I’ve been working on a replacement for fail2ban, and Ilia is recently helping polish up the Webmin module…we plan to ship it in the next major version of Virtualmin.

I’ve been running it on my servers from almost the first weekend of development, and it’s mostly pretty solid for everything I used fail2ban and sshguard for, while being significantly smaller and more efficient than either.

I recently noticed it’s relying on some stuff that isn’t present on older EL versions, though…since you’re on AlmaLinux 8, you might find it complains about unknown values in the systemd unit, but I think it still works. I only recently started testing on older systems, so didn’t notice earlier…but, also since EL 8 reached the end of full maintenance in 2024, and is only getting security updates and we probably won’t try to support it with the next major version of the Virtualmin installer (we don’t support distros in the installer past that fully maintained period, but we keep supporting EL throughout the security lifecycle for our own package updates).

Anyway, that’s me saying there is an alternative for CSF and fail2ban that I’ll begin recommending pretty soon, and it’s what we’ll be shipping in our products/projects. It does everything I used fail2ban or sshguard for, and I believe it does all of the intrusion prevention stuff CSF does (though I’ve never used CSF), and it does it in a much lighter way, pushing all of the complexity down into the kernel layer…nftables rules carry their own expiration, for example, so we don’t have to store a bunch of metadata about the banned IPs.

It works with nftables natively, but also works in a firewalld or iptables system that’s using the nftables backend, as it creates and manages its own nftables rules. But, since you don’t need firewalld, that’s another bit of complexity you can drop.

Whether you want to use it in production is up to you; you can also run it alongside another tool. It coexists with fail2ban (though depending on configuration, one or the other may not ever reach a bannable limit, since the IP might already be blocked by the other tool).

I welcome bug reports, and discussion of features that you use in CSF or fail2ban or whatever that aren’t covered by minsec. I won’t promise to implement every feature; being extremely, shockingly, tiny, is a hard requirement for minsec, but if it’s not resource intensive, I’ll certainly consider adding anything you think it ought to have. I’ll also note that minsec has features that fail2ban (and maybe CSF) don’t have…crowd-sourced ban lists and an RBL interface. I think the API and CLI are notably better, as well.

6

Oh, also note that because minsec runs as an unprivileged user (unlike all the others which run as root), there will be some pain points as we find all the places we need ACLs or some capability or something to interact with it. The journal works, Apache access logs, including those created by Virtualmin, should work (assuming you install with the package which adds the necessary access via tmpfiles.d entries), but other stuff may still have problems reading the logs. It’s one of the things I’m working on before calling it done.

7

Now that you mention it I should probably update AlmaLinux on that VPS.

8

Yeah, you’re still getting security updates for another year, or whatever, but I like to starting planning the migration as soon as it reaches the end of full support. From a security perspective, I think it’s more likely to get patches a bit faster if it’s the current version.

9

Some of the stuff I like with CSF GUI:
Port restrictions
Country Code bans

cPanel and CSF:
Install OWASP rules via easyapache, then in CSF set LF_MODSEC to X to automatically block an IP in the firewall after X ModSecurity rule violations. Other settings allow block permanent rather than temporary, or temporary for configurable time in seconds or after nominated number of violations.

10

I’m not sure I know what this means? Just blocking ports? You can do that in the nftables module (or whatever firewall tool you use).

Is that a reasonable thing to do these days? I know it used to be common for preventing spam and attacks from common source countries, but with business and the web being so international, and with attackers being so much more sophisticated and well-resourced, it seems unlikely to actually do much positive. I’m willing to be wrong, but it wouldn’t be a job for minsec, it’d be a job for the firewall module (nftables in a Virtualmin system, going forward, historically firewalld). minsec is just about detecting attacks and responding. Any rules that are permanent or user-controlled would go elsewhere.

Also, note that if you enable the multiplayer mode in minsec (where crowdsourced data is fetched from our server), it would catch common sources…so if there’s a block of addresses in Russia or whatever hammering a bunch of people with some kind of attack, everybody participating in the crowdsourced feed would know about it. It’s experimental and is only getting data from a few servers right now (mostly just mine), but I suspect it’ll be helpful once a few thousand servers are participating.